FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Add support for an explicit remote path prefix by mbg · Pull Request #4014 · github/codeql-action · GitHub

/ codeql-action Public

Add support for an explicit remote path prefix - #4014

Merged
mbg merged 12 commits into
mainfrom
mbg/explicit-remote-prefix
Jul 16, 2026
ConversationCommits (12)ChecksFiles changed
Merged

Add support for an explicit remote path prefix#4014
mbg merged 12 commits into
mainfrom
mbg/explicit-remote-prefix

Conversation

mbg commented Jul 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

This is an alternative to #4012 which addresses the same issue. The first few commits here are the same as there and increase test coverage and refactor a couple of functions.

The approach to resolving the issue here is different, however: instead of trying to find the file locally as in #4012 and always treat ambiguous paths as remote paths, we instead add support for a prefix that allows user to explicitly indicate that a configuration file path is supposed to refer to a remote file.

Risk assessment

For internal use only. Please select the risk level of this change:

  • Low risk: Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only.

Which use cases does this change impact?

Workflow types:

  • Advanced setup - Impacts users who have custom CodeQL workflows.
  • Managed - Impacts users with dynamic workflows (Default Setup, Code Quality, ...).

Products:

  • Code Scanning - The changes impact analyses when analysis-kinds: code-scanning.
  • Code Quality - The changes impact analyses when analysis-kinds: code-quality.
  • Other first-party - The changes impact other first-party analyses.

Environments:

  • Dotcom - Impacts CodeQL workflows on github.com and/or GitHub Enterprise Cloud with Data Residency.
  • GHES - Impacts CodeQL workflows on GitHub Enterprise Server.

How did/will you validate this change?

  • Test repository - This change will be tested on a test repository before merging.
  • Unit tests - I am depending on unit test coverage (i.e. tests in .test.ts files).
  • End-to-end tests - I am depending on PR checks (i.e. tests in pr-checks).

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

  • Feature flags - All new or changed code paths can be fully disabled with corresponding feature flags.

How will you know if something goes wrong after this change is released?

  • Telemetry - I rely on existing telemetry or have made changes to the telemetry.
    • Dashboards - I will watch relevant dashboards for issues after the release. Consider whether this requires this change to be released at a particular time rather than as part of a regular release.
    • Alerts - New or existing monitors will trip if something goes wrong with this change.

Are there any special considerations for merging or releasing this change?

  • No special considerations - This change can be merged at any time.

Merge / deployment checklist

  • Confirm this change is backwards compatible with existing workflows.
  • Consider adding a changelog entry for this change.
  • Confirm the readme and docs have been updated if necessary.

mbg self-assigned this Jul 15, 2026
mbg requested a review from a team as a code owner July 15, 2026 15:03
Copilot AI review requested due to automatic review settings July 15, 2026 15:03
github-actions Bot added the size/M Should be of average difficulty to review label Jul 15, 2026
mbg requested review from henrymercer and mario-campos July 15, 2026 15:05
Copilot AI reviewed Jul 15, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

Warning

  • Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

Pull request overview

Adds an explicit :: prefix to disambiguate remote CodeQL configuration paths.

Changes:

  • Adds local/remote path prefix handling.
  • Refactors remote address parsing and test helpers.
  • Expands local and remote configuration tests.
Show a summary per file
File Description
src/config/file.ts Defines local and remote path prefixes.
src/config-utils.ts Routes prefixed paths and loads configurations.
src/config-utils.test.ts Tests local and remote path handling.
src/config/remote-file.ts Extracts new-format address parsing.
src/testing-utils.ts Exports a minimal assertion interface.
lib/entry-points.js Generated artifact; excluded from review.

Review details

Files excluded by content exclusion policy (1)
  • lib/entry-points.js
  • Files reviewed: 5/6 changed files
  • Comments generated: 4
  • Review effort level: Medium

Comment thread src/config-utils.ts
Comment thread src/config/file.ts Outdated
Comment thread src/config-utils.ts Outdated
Comment thread src/config-utils.ts Outdated
henrymercer previously approved these changes Jul 16, 2026
View reviewed changes

henrymercer left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

Bike shed about the prefix, but otherwise LGTM!

Comment thread src/config/file.ts Outdated
* are restricted to ASCII characters, '.', and '-'. The prefix chosen here does not interfere with
* those and is _unlikely_ (but not impossible) to appear in a local file path.
*/
export const REMOTE_PATH_PREFIX = "::";

henrymercer Jul 16, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

What about something like remote:? It's five additional characters but can't be confused with two : separator characters.

mbg Jul 16, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

I have no strong feelings on :: and am happy to change it to something else, but I don't think that remote: would be a good choice because, if you have a repo in your organisation named remote, e.g. remote:codeql.yml would be a valid remote file address that instructs us to fetch codeql.yml from org/remote, and a remote: prefix would clash with that and cause us to truncate it to just codeql.yml. That's why I think the prefix should start with a character that's not allowed in repo or org names.

henrymercer Jul 16, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

Good point, how about remote=org/repo@ref:path or remote(org/repo@ref:path)?

mbg Jul 16, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

I have changed the prefix to remote= in 3492b7e

mbg mentioned this pull request Jul 16, 2026
Closed
mbg requested review from Copilot and henrymercer and removed request for mario-campos July 16, 2026 11:45
Copilot AI reviewed Jul 16, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Choose a reason Spam Abuse Off Topic Outdated Duplicate Resolved Low Quality

Warning

  • Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

Review details

Files excluded by content exclusion policy (1)
  • lib/entry-points.js
  • Files reviewed: 5/6 changed files
  • Comments generated: 1
  • Review effort level: Medium

Comment thread src/config/file.ts
mbg enabled auto-merge July 16, 2026 11:50
mbg added this pull request to the merge queue Jul 16, 2026
Merged via the queue into main with commit 9e7c070 Jul 16, 2026
227 checks passed
mbg deleted the mbg/explicit-remote-prefix branch July 16, 2026 12:11
This was referenced Jul 16, 2026
Merged
Merged
mario-campos mentioned this pull request Jul 16, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
henrymercer henrymercer approved these changes

Assignees

mbg

Labels

size/M Should be of average difficulty to review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

Back | FazBrowse Home | New Git URL